Vulnerability-Lookup

SUSE-SU-2025:01551-1

Vulnerability from csaf_suse - Published: 2025-05-29 09:29 - Updated: 2025-05-29 09:29

Summary

Security update for go1.24

Severity

Moderate

Notes

Title of the patch: Security update for go1.24

Description of the patch: This update for go1.24 fixes the following issues: Update to go1.24.3 (bsc#1236217): Security fixes: - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715) Changelog: * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory * go#73082 os: Root.Open panics when opening a symlink referencing the root * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in supportedVersions * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/ runtime.OSLockThread * go#73192 runtime: -race data race map traceback report incorrect functions * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64 * go#73440 cmd/compile: infinite loop in the inliner * go#73500 cmd/go: +dirty in version stamping doesn't combine well with +incompatible

Patchnames: SUSE-2025-1551,SUSE-SLE-Module-Development-Tools-15-SP7-2025-1551

CVE-2025-22873

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

9 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2025…	self
https://bugzilla.suse.com/1236217	self
https://bugzilla.suse.com/1242715	self
https://www.suse.com/security/cve/CVE-2025-22873/	self
https://www.suse.com/security/cve/CVE-2025-22873	external
https://bugzilla.suse.com/1242715	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for go1.24",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for go1.24 fixes the following issues:\n\nUpdate to go1.24.3 (bsc#1236217): \n\nSecurity fixes:\n\n - CVE-2025-22873: Fixed os.Root permits access to parent directory (bsc#1242715)\n  \nChangelog:\n \n * go#73556 go#73555 security: fix CVE-2025-22873 os: Root permits access to parent directory\n * go#73082 os: Root.Open panics when opening a symlink referencing the root\n * go#73092 cmd/link: linkname directive on userspace variable can override runtime variable\n * go#73118 crypto/tls: ECH decodeInnerClientHello incorrectly rejects ClientHello with GREASE values in supportedVersions\n * go#73144 runtime: segmentation fault from vgetrandomPutState and runtime.growslice w/ runtime.OSLockThread\n * go#73192 runtime: -race data race map traceback report incorrect functions\n * go#73281 cmd/compile: program compiles to wasm but is invalid: go:wasmexport: integer too large\n * go#73379 runtime, x/sys/unix: Connectx is broken on darwin/amd64\n * go#73440 cmd/compile: infinite loop in the inliner\n * go#73500 cmd/go: +dirty in version stamping doesn\u0027t combine well with +incompatible\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-1551,SUSE-SLE-Module-Development-Tools-15-SP7-2025-1551",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_01551-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:01551-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-202501551-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:01551-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2025-May/039398.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1236217",
        "url": "https://bugzilla.suse.com/1236217"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1242715",
        "url": "https://bugzilla.suse.com/1242715"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22873 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22873/"
      }
    ],
    "title": "Security update for go1.24",
    "tracking": {
      "current_release_date": "2025-05-29T09:29:35Z",
      "generator": {
        "date": "2025-05-29T09:29:35Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:01551-1",
      "initial_release_date": "2025-05-29T09:29:35Z",
      "revision_history": [
        {
          "date": "2025-05-29T09:29:35Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.3-150000.1.23.1.aarch64",
                "product": {
                  "name": "go1.24-1.24.3-150000.1.23.1.aarch64",
                  "product_id": "go1.24-1.24.3-150000.1.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.3-150000.1.23.1.aarch64",
                "product": {
                  "name": "go1.24-doc-1.24.3-150000.1.23.1.aarch64",
                  "product_id": "go1.24-doc-1.24.3-150000.1.23.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.3-150000.1.23.1.aarch64",
                "product": {
                  "name": "go1.24-race-1.24.3-150000.1.23.1.aarch64",
                  "product_id": "go1.24-race-1.24.3-150000.1.23.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.3-150000.1.23.1.i586",
                "product": {
                  "name": "go1.24-1.24.3-150000.1.23.1.i586",
                  "product_id": "go1.24-1.24.3-150000.1.23.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.3-150000.1.23.1.i586",
                "product": {
                  "name": "go1.24-doc-1.24.3-150000.1.23.1.i586",
                  "product_id": "go1.24-doc-1.24.3-150000.1.23.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.3-150000.1.23.1.ppc64le",
                "product": {
                  "name": "go1.24-1.24.3-150000.1.23.1.ppc64le",
                  "product_id": "go1.24-1.24.3-150000.1.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
                "product": {
                  "name": "go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
                  "product_id": "go1.24-doc-1.24.3-150000.1.23.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.3-150000.1.23.1.ppc64le",
                "product": {
                  "name": "go1.24-race-1.24.3-150000.1.23.1.ppc64le",
                  "product_id": "go1.24-race-1.24.3-150000.1.23.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.3-150000.1.23.1.s390x",
                "product": {
                  "name": "go1.24-1.24.3-150000.1.23.1.s390x",
                  "product_id": "go1.24-1.24.3-150000.1.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.3-150000.1.23.1.s390x",
                "product": {
                  "name": "go1.24-doc-1.24.3-150000.1.23.1.s390x",
                  "product_id": "go1.24-doc-1.24.3-150000.1.23.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.3-150000.1.23.1.s390x",
                "product": {
                  "name": "go1.24-race-1.24.3-150000.1.23.1.s390x",
                  "product_id": "go1.24-race-1.24.3-150000.1.23.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.24-1.24.3-150000.1.23.1.x86_64",
                "product": {
                  "name": "go1.24-1.24.3-150000.1.23.1.x86_64",
                  "product_id": "go1.24-1.24.3-150000.1.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-doc-1.24.3-150000.1.23.1.x86_64",
                "product": {
                  "name": "go1.24-doc-1.24.3-150000.1.23.1.x86_64",
                  "product_id": "go1.24-doc-1.24.3-150000.1.23.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.24-race-1.24.3-150000.1.23.1.x86_64",
                "product": {
                  "name": "go1.24-race-1.24.3-150000.1.23.1.x86_64",
                  "product_id": "go1.24-race-1.24.3-150000.1.23.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.3-150000.1.23.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.aarch64"
        },
        "product_reference": "go1.24-1.24.3-150000.1.23.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.3-150000.1.23.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.ppc64le"
        },
        "product_reference": "go1.24-1.24.3-150000.1.23.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.3-150000.1.23.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.s390x"
        },
        "product_reference": "go1.24-1.24.3-150000.1.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-1.24.3-150000.1.23.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.x86_64"
        },
        "product_reference": "go1.24-1.24.3-150000.1.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.3-150000.1.23.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.aarch64"
        },
        "product_reference": "go1.24-doc-1.24.3-150000.1.23.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.3-150000.1.23.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.ppc64le"
        },
        "product_reference": "go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.3-150000.1.23.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.s390x"
        },
        "product_reference": "go1.24-doc-1.24.3-150000.1.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-doc-1.24.3-150000.1.23.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.x86_64"
        },
        "product_reference": "go1.24-doc-1.24.3-150000.1.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.3-150000.1.23.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.aarch64"
        },
        "product_reference": "go1.24-race-1.24.3-150000.1.23.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.3-150000.1.23.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.ppc64le"
        },
        "product_reference": "go1.24-race-1.24.3-150000.1.23.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.3-150000.1.23.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.s390x"
        },
        "product_reference": "go1.24-race-1.24.3-150000.1.23.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.24-race-1.24.3-150000.1.23.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.x86_64"
        },
        "product_reference": "go1.24-race-1.24.3-150000.1.23.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22873",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22873"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.x86_64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.x86_64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22873",
          "url": "https://www.suse.com/security/cve/CVE-2025-22873"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1242715 for CVE-2025-22873",
          "url": "https://bugzilla.suse.com/1242715"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-1.24.3-150000.1.23.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-doc-1.24.3-150000.1.23.1.x86_64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:go1.24-race-1.24.3-150000.1.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-05-29T09:29:35Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22873"
    }
  ]
}

CVE-2025-22873 (GCVE-0-2025-22873)

Vulnerability from cvelistv5 – Published: 2026-02-04 23:05 – Updated: 2026-02-05 15:03

Title

Improper access to parent directory of root in os

Summary

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

Severity

3.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-05 15:03 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

Go Google root Scorecard

References

5 references

URL	Tags
https://go.dev/cl/670036
https://go.dev/issue/73555
https://groups.google.com/g/golang-announce/c/UZo…
https://pkg.go.dev/vuln/GO-2026-4403
http://www.openwall.com/lists/oss-security/2025/05/06/2

Impacted products

1 product

Vendor	Product	Version
Go standard library	os	Affected: 0 , < 1.23.9 (semver) Affected: 1.24.0-0 , < 1.24.3 (semver)

Credits

Dan Sebastian Thrane of SDU eScience Center

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-04T23:08:02.625Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/06/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 3.8,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22873",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T15:03:11.291122Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-23",
                "description": "CWE-23 Relative Path Traversal",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T15:03:55.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "os",
          "product": "os",
          "programRoutines": [
            {
              "name": "splitPathInRoot"
            },
            {
              "name": "checkPathEscapesInternal"
            },
            {
              "name": "doInRoot"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.23.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.3",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Dan Sebastian Thrane of SDU eScience Center"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was possible to improperly access the parent directory of an os.Root by opening a filename ending in \"../\". For example, Root.Open(\"../\") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T23:05:24.803Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/670036"
        },
        {
          "url": "https://go.dev/issue/73555"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4403"
        }
      ],
      "title": "Improper access to parent directory of root in os"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22873",
    "datePublished": "2026-02-04T23:05:24.803Z",
    "dateReserved": "2025-01-08T19:11:42.835Z",
    "dateUpdated": "2026-02-05T15:03:55.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2025:01551-1

CVE-2025-22873 (GCVE-0-2025-22873)

Tags

Sightings

Nomenclature

Related by attack behaviour